Splunk Enterprise Security

ESS - Simple saved dashboard question

amtm
Engager

Within the ESS application, I created a simple saved dashboard based upon a search:
Splunk -> ESS -> Search
Specify search query -> Actions -> Add to dashboard

After going through the menu, and creating a new dashboard, naming the panel, etc, I had a tough time finding the newly created dashboard. It does not show up in a 'View' menu like the search app; However I was able to see the dashboard in the 'Manage Views' config menu (navigating through the search app). The app context was listed as SplunkESS, so I found I was able to get to the newly created dashboard by navigating to it via url/name directly:

https://mysplunkess:8000/en-US/app/SplunkEnterpriseSecuritySuite/_new_test_dashboard

The dashboard shows correctly, and I am able to edit it. However what I would like to do is have a link to this dashboard within ESS; so it shows up as a clickable menu item in the black navigation bar. When I go to the Domain / Dashboard config menu (Splunk > ESS > Configure > Domains / Dashboards) I do not see my '_new_test_dashboard' dashboard listed. Is there a conf file that needs to be edited directly?

0 Karma
1 Solution

MHibbin
Influencer

amtm,

I do not have access to an ESS installation. However normally to add a view/dropdown to the navigation, you would navigate to the App's navigational view area (i.e. ESS App >> Manager >> User Interface >> Navigation menus), and modify the "default.xml".

It's a pretty simple XML to add you view simply to the navigation bar add something like:

<view name="yourview" />

Probably best to add this at the very beginning or the very end.. so that it doesn't intefer with the core functionality.

Best practice would say to back the XML to a text file, "just in case".

Regards,

MHibbin

View solution in original post

jbillings
Path Finder

Very late to the party for this one, but from the Home page in the Enterprise Security App, select App configuration. This will take you to the ES Configuration. Under General, select Navigation. This will let you edit/add views to the menu.
Regards,
jbillings

0 Karma

MHibbin
Influencer

amtm,

I do not have access to an ESS installation. However normally to add a view/dropdown to the navigation, you would navigate to the App's navigational view area (i.e. ESS App >> Manager >> User Interface >> Navigation menus), and modify the "default.xml".

It's a pretty simple XML to add you view simply to the navigation bar add something like:

<view name="yourview" />

Probably best to add this at the very beginning or the very end.. so that it doesn't intefer with the core functionality.

Best practice would say to back the XML to a text file, "just in case".

Regards,

MHibbin

MHibbin
Influencer

cool, nice one!

0 Karma

amtm
Engager

That did the trick! Thank you very much. I added this code at the end:

<collection label="Custom Dashboards">
<view name="_new_test_dashboard"/>
</collection>
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How to Break a Kubernetes Pod on Purpose and Let the AI Troubleshooting Agent Find ...

Let's say I've just rolled out a Kubernetes Deployment with a typo in the image tag. Nothing explodes. The pod ...

Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster

The updated Splunk Add-on for Microsoft Windows helps customers search Windows events faster by reducing ...

What's New in Splunk Enterprise Security 8.8 and Beyond

Threats move at machine speed. Keeping up should not depend on having the biggest budget, the largest team, or ...